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Abstract 

Regenerating codes provide an efficient way to recover data at failed nodes in distributed storage 
systems. It has been shown that regenerating codes can be designed to minimize the per-node storage 
(called MSR) or minimize the communication overhead for regeneration (called MBR). In this work, 
we propose new encoding schemes for [n, d\ error-correcting MSR and MBR codes that generalize 
our earlier work on error-correcting regenerating codes. We show that by choosing a suitable diagonal 
matrix, any generator matrix of the [71, a] Reed-Solomon (RS) code can be integrated into the encoding 
matrix. Hence, MSR codes with the least update complexity can be found. By using the coefficients 
of generator polynomials of [71, k] and [71, d] RS codes, we present a least-update-complexity encoding 
scheme for MBR codes. An efficient decoding scheme is proposed that utiUzes the [n, a] RS code to 
perform data reconstruction for MSR codes. The proposed decoding scheme has better error correction 
capability and incurs the least number of node accesses when errors are present. A new decoding scheme 
is also proposed for MBR codes that can correct more error-patterns. 
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I. Introduction 

Cloud storage is gaining populaiity as an alternative to enterprise storage where data is stored 
in virtualized pools of storage typically hosted by third-party data centers. Reliability is a key 
challenge in the design of distributed storage systems that provide cloud storage. Both crash- 
stop and Byzantine failures (as a result of software bugs and malicious attacks) are likely to be 
present during data retrieval. A crash-stop failure makes a storage node unresponsive to access 
requests. In contrast, a Byzantine failure responds to access requests with erroneous data. To 
achieve better reliability, one common approach is to replicate data files on multiple storage 
nodes in a network. There are two kinds of approaches: duplication (Google) and erasure 
coding [|2l, [Q. Duplication makes an exact copy of each data and needs lots of storage space. 
The advantage of this approach is that only one storage node needs to be accessed to obtain 
the original data. In contrast, in the second approach, erasure coding is employed to encode the 
original data and then the encoded data is distributed to storage nodes. Typically, more than one 
storage nodes need to be accessed to recover the original data. One popular class of erasure 
codes is the maximum-distance-separable (MDS) codes. With [n, k] MDS codes such as Reed- 
Solomon (RS) codes, k data items are encoded and then distributed to and stored at n storage 
nodes. A user or a data collector can retrieve the original data by accessing any k of the storage 
nodes, a process referred to as data reconstruction. 

Any storage node can fail due to hardware or software damage. Data stored at the failed 
nodes need to be recovered (regenerated) to remain functional to perform data reconstruction. 
The process to recover the stored (encoded) data at a storage node is called data regeneration. A 
simple way for data regeneration is to first reconstruct the original data and then recover the data 
stored at the failed node. However, it is not efficient to retrieve the entire B symbols of the original 
file to recover a much smaller fraction of data stored at the failed node. Regenerating codes, first 
introduced in the pioneer works by Dimakis et a/, in [31, [[51, allow efficient data regeneration. To 
facilitate data regeneration, each storage node stores a symbols and a total of d surviving nodes 
are accessed to retrieve (3 < a symbols from each node. A trade-off exists between the storage 
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overhead and the regeneration (repair) bandwidth needed for data regeneration. Minimum Storage 
Regenerating (MSR) codes first minimize the amount of data stored per node, and then the repair 
bandwidth, while Minimum Bandwidth Regenerating (MBR) codes carry out the minimization 
in the reverse order. There have been many works that focus on the design of regenerating 
codes [[6l- lfT3l . Recently, Rashmi et al. proposed optimal exact-regenerating codes that recover 
the stored data at the failed node exactly (and thus the name exact-regenerating) [[T3l : however, 
the authors only consider crash-stop failures of storage nodes. Han et al. extended Rashmi's work 
to construct error-correcting regenerating codes for exact regeneration that can handle Byzantine 
failures [il4]. In [[T4l. the encoding and decoding algorithms for both MSR and MBR error- 
correcting codes were also provided. In [15], the code capability and resilience were discussed 
for error-correcting regenerating codes. 

In addition to bandwidth efficiency and error correction capability, another desirable feature 
for regenerating codes is update complexity [|T6l . defined as the maximum number of encoded 
symbols that must be updated while a single data symbol is modified. Low update complexity is 
desirable in scenarios where updates are frequent. Clearly, the update complexity of a regener- 
ating code is determined by the number of non-zero elements in the row of the encoding matrix 
with the maximum Hamming weight. The smaller the number, the lower the update complexity 
is. 

One drawback of the decoding algorithms for MSR codes given in [[T4| is that, when one 
or more storage nodes have erroneous data, the decoder needs to access extra data from many 
storage nodes (at least k more nodes) for data reconstruction. Furthermore, when one symbol 
in the original data is updated, all storage nodes need to update their respective data. Thus, the 
MSR and MBR codes in ||T4|| have the maximum possible update complexity. Both deficiencies 
are addressed in this paper. First, we propose a general encoding scheme for MSR codes. As a 
special case, least- update-complexity codes are designed. We also design least-update-complexity 
encoding matrix for the MBR codes by using the coefficients of generator polynomials of the 
[n, k] and [n, d\ RS codes. Second, a new decoding algorithm is presented for MSR codes. It 
not only provides better error correction capability but also incurs low communication overhead 
when errors occur in the accessed data. Third, we devise a more efficient decoding scheme for 
the MBR codes that can correct more error patterns compared to the one in [[T4| . 

The rest of this paper is organized as follows. Section |ll] gives an overview of error-correcting 
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regenerating codes. Section In] presents the least-update-complexity encoding and efficient de- 
coding schemes for error-correcting MSR regenerating codes. Section ITVl demonstrates the least- 
update-complexity encoding of MBR codes and the corresponding decoding scheme. Section |V] 
details evaluation results for the proposed decoding schemes. Section |Vl] concludes the paper 
with a list of future work. Since only error-correcting regenerating codes are considered in this 
work, unless stated otherwise, we refer to error-correcting MSR and MBR codes as MSR and 
MBR codes in the rest of the paper. 

II. Error-Correcting Regenerating Codes 

In this section, we give a brief overview of data regenerating codes, the MSR and MBR code 
constructions in lfT4l . 

A. Regenerating Codes 

Let a be the number of symbols stored at each storage node and /3 < a the number of symbols 
downloaded from each storage during regeneration. To repair the stored data at the failed node, 
a helper node accesses d surviving nodes. The design of regenerating codes ensures that the 
total regenerating bandwidth be much less than that of the original data, B. A regenerating code 
must be capable of reconstructing the original data symbols and regenerating coded data at a 
failed node. An [n, k, d] regenerating code requires at least k nodes to ensure successful data 
reconstruction, and d surviving nodes to perform regeneration [TS], where n is the number of 
storage nodes and k < d < n — 1. 

The cut-set bound given in [[51, flU provides a constraint on the repair bandwidth. By this 
bound, any regenerating code must satisfy the following inequality: 



From (HI), a or (3 can be minimized achieving either the minimum storage requirement or the 
minimum repair bandwidth requirement, but not both. The two extreme points in ([T) are referred 
to as the minimum storage regeneration (MSR) and minimum bandwidth regeneration (MBR) 
points, respectively. The values of a and (3 for the MSR point can be obtained by first minimizing 



fc-i 




(1) 



i=0 
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a and then minimizing [3: 

a = d — k + 1 

B = k{d-k + l) = ka , (2) 

where we normalize /3 and set it equal to iQ Reversing the order of minimization we have a 
for MBR as 

a = d 

B = kd-k{k-l)/2 , (3) 

while f3 = l. 

There are two categories of approaches to regenerate data at a failed node. If the replacement 
data is exactly the same as that previously stored at the failed node, we call it exact regeneration. 
Otherwise, if the replacement data only guarantees the correctness of data reconstruction and 
regeneration properties, it is cdXXQd functional regeneration. In practice, exact regeneration is more 
desirable since there is no need to inform each node in the network regarding the replacement. 
Furthermore, it is easy to keep the codes systematic via exact regeneration, where partial data 
can be retrieved without accessing all k nodes. The codes designed in [fT3l , [fT4ll allow exact 
regeneration. 

B. MSR Regenerating Codes With Error Correction Capability 

Next, we describe the MSR code construction given in [fT4l . Here, we assume d = 2a. The 
information sequence m = [mg, mi, . . . , m^-i] can be arranged into an information vector 
U = [Z1Z2] with size a x d such that Zi and Z2 are symmetric matrices with dimension a x a. 
An [n, d = 2a] RS code is adopted to construct the MSR code [fT4l|. Let a be a generator of 
GF{2'^). In the encoding of the MSR code, we have 

U -0 = 0, (4) 

* It has been proved that when designing [n, fc, d] MSR codes for fc/(n+l) < 1/2. it suffices to consider those with /3 = 1 1131 . 
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where 



G 



a" 

0\2 



1\2 



1 

n-l\2 



[a 



,n-l\d-l 



and C is the codeword vector with dimension (a x n). 

It is possible to rewrite generator matrix G of the RS code as, 



G 



1 

a" 
a°)°l 



1 



,l^2 



.l^a-l 



1 



-.n— 1 



(5) 



(6) 



where G contains the first a rows in G, and A is a diagonal matrix with (a°)", (a^)", (a^)", . . . , (a" 
as diagonal elements, namely. 



(a°)" ■■■ 
ia^T ■■■ 



■■■ fa 



n—l\a 



(7) 



Note that if the RS code is over GF(2'^) for m > [log2 no] , then it can be shown that 



(a^r, (a^r, (a^r. 



are all distinct. According to the encoding procedure, the 
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a symbols stored in storage node i are given by, 



U ■ 



9i 



(a^-ygj 



where gj is the ith column in G. 



C. MBR Regenerating Codes With Error Correction Capability 

In this section, we describe the MBR code constructed in [fT4l . Note that at the MBR point, 
a = d. Let the information sequence m = [mo, mi, . . . , niB-i] be arranged into an information 
vector U with size a x d, where 



U 



A. 



(8) 



is a /c X /c symmetric matrix, A2 di {d — k) xk matrix, is the {d — k) x {d — k) zero matrix. 
Note that both Ai and U are symmetric. It is clear that U has a dimension d x d {ox a x d). 
An [n, d] RS code is chosen to encode each row of U. The generator matrix of the RS code is 
given as 



G 



1 



a" 

0\2 



A\2 



1 

n-l\2 



[a 



,n-l\fc-l 



,n-l\d-l 



(9) 



where a is a generator of GF{2"^). Let G be the codeword vector with dimension {a x n). It 
can be obtained as 

U-G = G. 



From do]), G can be divided into two sub-matrices as 

Gk 
B 



G 



(10) 
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where 



and 



[a 



0\2 



,l^2 



B 



1 



(11) 



It can be shown that Gk is a generator matrix of the [n, k] RS code and it will be used in the 
decoding for data reconstruction. 



III. Encoding and Decoding Schemes for MSR Codes 

In this section, we propose a new encoding scheme for [n, d] error-correcting MSR codes. 
With a feasible matrix A, G in ([61) can be any generator matrix of the [n, a] RS code. The code 
construction in [fT4l is thus a special case of our proposed scheme. We can also select a suitable 
generator matrix such that the update complexity of the resulting code is minimized. An efficient 
decoding scheme is then proposed that uses the subcode of the [n, d] RS code, the [n, a = /c — 1] 
RS code generated by G, to perform the data reconstruction. 



A. Encoding Schemes for Error-Correcting MSR Codes 



RS codes are known to have very efficient decoding algorithms and exhibit good error 
correction capability. From (l6) in Section III-Bl a generator matrix G for MSR codes needs 
to satisfy: 

G 



1) G 



GA 



, where G contains the first a rows in G and A is a diagonal matrix with 



distinct elements in the diagonal. 
2) G is a generator matrix of the [n, a] RS code and G is a generator matrix of the [n, d = 2a] 
RS code. 
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Next, we present a sufficient condition for G and A such that G is a generator matrix of an \n, d] 
RS code. We first introduce some notations. Let goy{x) = YYi=o~^ ~ ^'') ^^'^ '^he [n, y] RS code 
generated by goyix) be Coy. Similarly, let giy{x) = Y\A=ii^~^^) ^'^^ '^he [n, y] RS code generated 
by giy{x) be Ciy. Clearly, a°, a\ a^, . . . , a"~^^^ are roots of goyix), and a^, a^, . . . , a"~^ are roots 
of giy{x). Thus, Coy and Ciy are equivalent RS codes. 

Theorem 1: Let G be a generator matrix of the [n, a] RS code Cqq,. Let the diagonal elements 
of A be ^1, • • • 5 bn-i such that bi ^ bj for all i ^ j, and (60, • • • , &n-i) is a codeword in 



but not Ci(a). In other words, {bo,bi 

G 



all nonzero c G Coa. Then, G 



GA 



, . . . , bn-i) e Gi(„+i)\Gi„. Also let cA ^ Go„ for 



is a generator matrix of the [n, ci] RS code C^ 



Od- 



Proof: We need to prove that each row of GA is a codeword of God and all rows in G 
are linearly independent. Let Goa be the dual code of Goa- It is well-known that Gqq is an 
[n,n — a] RS code ifTTl . [[TSl . Similarly, let God be the dual code of God and its generator 
matrix be Hd- Note that Hd is a parity-check matrix of God- Let /^^(x) = (x" — l)/5'od(2^) and 



^a(a^) = (a^" — l)/5'oa(a^)- Then, the roots of hd{x) and ha{x) are a 



n— d „n— d+l 



and 



„?i— o „n— Q+1 



, respectively. Since an RS code is also a cyclic code, then the generator 



polynomials of God and Goa are hd{x) and ha{x), respectively, where hd{x) 



X 



n—d 



hd{x ^) and 



-(n-d) 



ha{x) = x"''°'ha{x^^). Clearly, the roots of hd{x) are a "■>,a 
equivalent to a^, a^"^, . . . , a^. Similarly, the roots of ha{x) are a", a°~^ 
roots of a'^, a*^"^, . . . , a\ we can choose 



("-'^+i),...,a-("-i) that are 
. ,a} . Since /id (2;) has 



1 

a" 

0N2 



a 



-fi\n-d-l 



1 

1\2 



A\n~d-l 



1 



-.n— l\n— d— 1 



(12) 



as the generator matrix of God- To prove that each row of GA is a codeword of the RS code God 
generated by G, it is sufficient to show that GAHj = 0. From the symmetry of A, we have 

GAHj = GiHdAf. 

Thus, we only need to prove that each row of HdA is a codeword in Goq. Let the diagonal 
elements of A be bo, • • • , &n.-i- The ith row of HdA is thus rj(x) = Yl]=o bj{a^y~^x^ in the 
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polynomial representation. Since each row of i/^A must be a codeword in Cqo, it follows that 
ri(a^) = for 1 < £ < a and 1 < i < n - d. Note that 

n— 1 n—1 
j=0 j=0 

Since i — 1 + £ runs from 1 to n — d — 1 + a = n — a — 1, we have 

n-1 

bj{a^'y = for 1 < f < n - a - 1 . (13) 

j=0 

It is easy to see that the 6jS satisfying (fT3l) are all codewords in Ci(a+i)- 

The 6jS need to make all rows in G linearly independent. Since all rows in G or those in 
GA are linear independent, it is sufficient to prove that Cqq, fl Ga = {0}, where Ca is the code 
generated by GA. Let c' be a codeword in Ca- c' = cA for some c G Cqq. Consider some 
special codewords in Goa- It can be shown that, by the Mattson-Solomon polynomial l|T9l , we 
can choose 



G 



,0\2 



.1\2 



,n-l\2 



(14) 



as the generator matrix of Cqq. We can then select the ith row from G in (fT4)) as c, where 
1 < i < a. Assume that cA G Cqq. Note that cA(x) has a°, a^, a^, . . . , a"~"~^ as roots. Hence, 



we have 



n-1 



bj{a'+y = OforO<i<n-a-l. 

3=0 



(15) 



From (fTJt . it is easy to see that if Xlj=o ^j{^^~"y = 0' i-^-' is a root of YTj=Q bjx^ , 

then (fT5l) holds for at least one i (e.g., z = 1). Thus, we need to exclude the codewords in 
Ci(a+i) that have a"~° as root. These codewords turn out to be in Gia- ■ 
Corollary 1: Under the condition that the RS code is over GF(2"') for m > [loggn] and 
gcd(2'^ — 1, tt) = 1, the diagonal elements of A, bo, &i, • • • , ^n-i. can be 



7(a°)-,7(a)",7(a')",---,7K-') 



n—l\a 



where 7 G G'F(2'")\{0}. 
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Proof: Note that one valid generator matrix of Cif^a+i) is 



1 



1 



1 



a 







a 



a 



n-1 



(a0)2 {a^f 




(16) 




(6o, hi,..., hn-i) G Ci(c,+i)\Cic, can be represented as bi = 7(0^)°+/^, where (/o, /i, . . . , /„-i) G 
Ci Q,. Now choose (/o, fi, ■ ■ ■ , fn-i) to be all zero codeword. Under the condition that the RS code 
is over GF{2"') for m > [logg n] and gcd(2'" - 1, a) = 1, 7(0°)", 7(a)", 7(0^)", . . . , 7(0""^)" 
is equivalent to 7(0")°, 7(0")"^, 7(0")^, . . . , 7(0°^)""^. If a" is a generator of GF(2™'), then 
all elements of 7(0")°, 7(0")^, 7(0")^, . . . , 7(a")"~^ are distinct. It is well-known that a" is 
a generator if gcd(2'" — 1, a) = 1. Next we prove that cA ^ Cqq for all nonzero c G Cqq, by 
contradiction. Let c = (cq, Ci, . . . , c„_i). Then the polynomial representation of cA is 



Assume that cA G Cqq,. Then 7 ^"Jq^ Cj(a"x)' must have roots a°, a^, . . . , a"~"~^. It follows that 
c(x) must have a°, a"'"'"^, . . . , a"~^ as roots. Recall that c(x) also has roots a°, a^, a^, . . . , a"""""^. 
Since n — 1 > (i = 2a;, we have n — a — 1 > a. Hence, c(x) has n roots of a°, a^, a^, . . . , a""^. 
It is a contradiction since the degree of c{x) is at most n — 1. Thus, we conclude cA ^ Cqq,. ■ 

It is clear that by setting 7 = 1 in Corollary [T] we obtain the generator matrix G given in ^ 
first proposed in [|l4l as a special casej^ 

One advantage of the proposed scheme is that it can now operate on a smaller finite field than 
that of the scheme in [[T4l|. Another advantage is that one can choose G (and A accordingly) 
freely as long as G is the generator matrix of an [n, a] RS code. In particular, as discussed in 
Section H to minimize the update complexity, it is desirable to choose a generator matrix that 
has the least row-wise maximum Hamming weight. Next, we present a least- update-complexity 
generator matrix that satisfies dH). 

^Even though the roots in G given in ^ are different from those for the proposed generator matrix, they generate equivalent 
RS codes. 



n-1 



i=0 
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Corollary 2: Suppose A is chosen according to Corollary [T] Let G be the generator matrix 
associated with a systematic [n, a] RS code. That is, 



where 



and 



Then, G 





boo 


boi 


bo2 


bo{n~a~l) 


1 





■ 


■ 




bio 


bu 


bi2 


bl{n-a-l) 





1 


■ 


■ 


G = 




b2i 


b22 


&2(n-a-l) 







1 ■ 


■ 




_ b(a-l)0 


b(a-l)l 


b(a-l)2 ■ 


■ ^(a-l){n-o-l) 








■ 


■ 1 



X 



n—a+i 



Ui{x)g{x) + bi{x) for < i < q; — 1 



G 

OA 



bi{x) = bio + hix H h 6i(n-a-i)a;" " ^ 

is a least-update-complexity generator matrix. 



(17) 



Proof: The result holds since each row of G is a nonzero codeword with the minimum 
Hamming weight n — a + 1. ■ 



B. Efficient Decoding Scheme for MSR Codes 

Unlike the decoding scheme in lfT4l that uses [n, d] RS code, we propose to use the subcode of 
the [n, d] RS code, i.e., the [n, a = k — 1] RS code generated by G, to perform data reconstruction. 
The advantage of using the [n, A; — 1] RS code is two-fold. First, its error correction capability 
is higher. Specifically, it can tolerate [ "^^+1 ] instead of [^^J errors. Second, it only requires 
the access of two additional storage nodes (as opposed tod — k + 2 = k nodes) for each extra 
error. 

Without loss of generality, we assume that the data collector retrieves encoded symbols from 
k + 2v (v > 0) storage nodes, jo, ji, • • • ,jk+2v-i- We also assume that there are v storage nodes 
whose received symbols are erroneous. The stored information on the k + 2v storage nodes 
are collected as the k + 2v columns in Yax(k+2v)- The k + 2v columns of G corresponding to 
storage nodes jo, ji, • • • , jfc+2v-i are denoted as the columns of Gk+2v First, we discuss data 
reconstruction when v = 0. The decoding procedure is similar to that in [flBl . 
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No Error: In this case, v = and there is no error in Y. Then, 



Y 



axk 



[Z1Z2] 



Gk 

= [ZiGk + Z2GkA] . 
Multiplying Gl to both sides of ([H]), we have fT3l|, 

= P + QA . 



(18) 



(19) 



Since Zi and Z2 are symmetric, P and Q are symmetric as well. The (i, j)th element of 

P + QA, 1 < i,j < k and i ^ j, is 

P^J + g.,a(^-^)" , (20) 

and the (j, i)th element is given by 

p^.. + . (21) 

Since a'--^^^'^" ^ a*^*"^)" for all i ^ j, pij = pji, and qij = qji, combining (l20l) and (|2T]) . the 
values of and can be obtained. Note that we only obtain k — 1 values for each row of P 
and Q since no elements in the diagonal of P or Q are obtained. 

To decode P, recall that P = G^ZiGk- P can be treated as a portion of the codeword 
vector, G\ZiG. By the construction of G, it is easy to see that G is a generator matrix of the 
[n, /c — 1] RS code. Hence, each row in the matrix G^ZiG is a codeword. Since we know k — 1 
components in each row of P, it is possible to decode G^ZiG by the error-and-erasure decoder 
of the [n, A; - 1] RS codeE 

Since one cannot locate any erroneous position from the decoded rows of P, the decoded a 
codewords are accepted as G^ZiG. By collecting the last a columns of G as Ga to find its 

' The error-and-erasure decoder of an [n, k — 1] RS code can successfully decode a received vector if s + 2v < n — k + 2, 
where s is the number of erasure (no symbol) positions, v is the number of errors in the received portion of the received vector, 
and 71 — A: + 2 is the minimum Hamming distance of the [n, fc — 1] RS code. 
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inverse (here it is an identity matrix), one can recover Gj^Zi from G'j^ZiG. Since any a rows 
in G'jl are independent and thus invertible, we can pick any a of them to recover Zi. Z2 can be 
obtained similarly by Q. 

Single Error: In this case, v = 1 and only one column of Yax(k+2) is erroneous. Without loss 
of generality, we assume the erroneous column is the first column in Y . That is, the symbols 
received from storage node jo contain error. Let E = [e^|0] be the error matrix, where ei = 
[eii, ei2,, . . . , cia] and is all zero matrix with dimension ax (k + 1). Then 



Yr 



ax{k+2) 



UGk+2 + E 

Gk+2 
Gk+2A 

[ZlGk+2 + Z2Gk+2'^] 



[ZIZ2 



E 



E 



(22) 



Multiplying 6*^.4,2 to both sides of (I22|) . we have 



Gk+2^ax{k+2) 



Gk+2UGk+2 



GI+2E 



[Gk+2ZlGk+2 + G'^+2^2G'fc+2A] + Gfe+2-^ 

P + QA+ [01^2^1 \0] 
P + QA . 



(23) 



It is easy to see that the errors only affect the first column of P + QA since the nonzero 
elements are all in the first column of [G^^g^f |0] • Similar to (l20t and (|2T)) . the values of pij and 
Qij, where i j, are obtained from G'|^2^ax(fc+2) even though there are some errors in them. 
Note that we only obtain A; + 1 values for each row of P and Q. Since the (j, l)th elements of 
^fe+2^ax(fc+2) may be erroneous for 1 < j < A; + 2, the values calculated from them contain 
errors as well. Then the first column and the first row of P (Q) have errors. Note that each row 
of P (Q) has only at most one error except the first row. 

First, we decode P. Recall that P = G'^_^2^i'-^fc+2- As mentioned earlier, P can be treated as 
a portion of the codeword vector G'^.^g^i^' ^i^^ then P can be decoded by the [n, A; — 1] RS 
code. Since we have obtained k + 1 components in each row of P, it is possible to correctly 
decode each row of (51^2-^1 '5', except for the first row of P, using the error-and-erasure decoder 
of the RS code. 
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Let P be the corresponding portion of decoded codeword vector to P and Ep = P Q) P he 
the error pattern vector. Next we describe how to locate the incorrect row after decoding every 
row (in this case we assume that the error occurs in the first row). Now suppose that there are 
more than two errors in the first column of Let these errors be in (ji, l)th, (j2, l)th,- ■ ■ , and 
{ji, l)th positions in P. After decoding all rows of P, it is easy to see that all rows but the first 
row can be decoded correctly due to at most one error occurring in each row. Then one can 
confirm that the number of nonzero elements in Ep in the first column is at least three since 
only the error in the first position of the first column can be decoded incorrectly. Other than the 
first column in Ep there is at most one nonzero element in rest of the columns. Then the first 
column in P has correct elements except the one in the first row. Just copy all elements in the 
first column of P to those corresponding positions of its first row to make P a symmetric matrix. 
We then collect any a columns of P except the first column as Pa and find its corresponding 
Ga- By multiplying the inverse of Ga to Pa, one can recover G]^^2^i- Since any a rows in 
(5|^2 independent and thus invertible, we can pick any a of them to recover Zi. Z2 can be 
obtained similarly by Q. 

Multiple Errors: Before presenting the proposed decoding algorithm, we first prove that a 
decoding procedure can always successfully decode Zi and Z2 if v < [ ""2"*"^ J storage 
nodes are accessed. Assume the storage nodes with errors correspond to the ^oth, £ith, . . ., £^_ith 
columns in the received matrix Yaxn- Then, 



G^Y, 



G^UG + G^E 



G^[Z,Z,] 



G 



+ G^E 



GA 



[G^ZiG + G^Z2GA] + G^E , 



(24) 



where 



E — Oax{io-l)\^eo\^ax{ei-eo-l)\ • ■ • \^e„-i\Oax{n-l^-i) 



''it will be shown later that the number of errors in the first column of P is at least three. 
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Lemma 1: There are at least n — k + 2 errors in each of the ioth, £ith, . . ., £t,_ith columns 

of G^Yaxn- 

Proof: From (l24l ). we have 

G^l^axn = P + gA + G^E. 

The error vector in ijth column is then 

G^el = {ee^Gf . (25) 

Since G is a generator matrix of the [n, A; — 1] RS code, e^^G in (l25l) is a nonzero codeword in 
the RS code. Hence, the number of nonzero symbols in ei^G is at least n — k + 2, the minimum 
Hamming distance of the RS code. ■ 
We next have the main theorem to perform data reconstruction. 

Theorem 2: Let G^Faxn = P + Q^. Furthermore, let P be the corresponding portion of 
decoded codeword vector to P and Ep = P ® P he the error pattern vector. Assume that the 
data collector accesses all storage nodes and there are f , 1 < < [^^— f-^-^J , of them with errors. 
Then, there are at least n — k + 2 — v nonzero elements in ^jth column of Ep, < j < f — 1, 
and at most v nonzero elements in the rest of the columns of Ep. 

Proof: Let us focus on the Ijih. column of Ep. By Lemma [H there are at least n — k + 2 
errors in the ijth column of G^Yaxn- P is constructed from G'^Yaxn based on (|20|) and (|2TI) . 
If there is only one value of (|20|) and (|2TI) that is in error, then the constructed Pij and qij will 
be in error. However, when both values are in error, pij and qij might accidentally be correct. 
Among those n — k + 2 erroneous positions, there are at least n — k + 2 — v positions in error 
after constructing P since at most v errors can be corrected in constructing P. It is easy to 
see that at least n — k + 2 — v positions are in error that are not among any of the £oth, ^ith, 
. . ., £t,_ith elements in the ^jth column. These errors are in rows that can be decoded correctly. 
Hence, there are at least n — k + 2 — v errors that can be located in £jth column of P such that 
there are at least n — k + 2 — v nonzero elements in the ijih. column of Ep. There are at most 
V rows in P that cannot be decode correctly due to having more than v errors in each of them. 
Hence, other than those columns with errors in the original matrix G^Yaxn, at most v errors 
will be found in each of the rest of the columns of P. ■ 
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errors 



The above theorem allows us to design a decoding algorithm that can correct up to [ " ^"'"^ J 



In particular, we need to examine the erroneous positions in G E. Since I < v < 
l^ n-fc+i j ^ we have n — k + 2 — v > [ "^^+^ J + 1 > ti. Thus, the way to locate all erroneous 
columns in P is to find out all columns in Ep where the number of nonzero elements in them 
are greater than or equal to [ "~^+i J + i. After we locate all erroneous columns we can follow 
a procedure similar to that given in the no error (or single error) case to recover Zi from P. 

The above decoding procedure guarantees to recover Zi (Z2) when all n storage nodes are 
accessed. However, it is not very efficient in terms of bandwidth usage. Next, we present a 
progressive decoding version of the proposed algorithm that only accesses enough extra nodes 
when necessary. Before presenting it, we need the following corollary. 

Corollary 3: Consider that one accesses k + 2v storage nodes, among which v nodes are 
erroneous and 1 < f < [ "^^+^ J . There are at least v + 2 nonzero elements in the ijth column 
of Ep, < j < V — 1, and at most v among the remaining columns of Ep. 

Proof: This is a direct result from Theorem |2] when we delete n— (k + 2v) elements in each 
column of Ep according to the size of Yax{k+2v) and n — k + 2 — v — {n — {k + 2v)} = v + 2. ■ 
Based on Corollary |3l we can design a progressive decoding algorithm [|20l that retrieves extra 
data from the remaining storage nodes when necessary. To handle Byzantine fault tolerance, it 
is necessary to perform integrity check after the original data is reconstructed. Two verification 
mechanisms have been suggested in [fT4|: cyclic redundancy check (CRC) and cryptographic hash 
function. Both mechanisms introduce redundancy to the original data before they are encoded 
and are suitable to be used in combination with the decoding algorithm. 

The progressive decoding algorithm starts by accessing k storage nodes. Error- and-erasure 
decoding succeeds only when there is no error. If the integrity check passes, then the data 
collector recovers the original data. If the decoding procedure fails or the integrity check fails, 
then the data collector retrieves two more blocks of data from the remaining storage nodes. Since 
the data collector has k + 2 blocks of data, the error-and-erasure decoding can correctly recover 
the original data if there is only one erroneous storage node among the k + 1 nodes accessed. 
If the integrity check passes, then the data collector recovers the original data. If the decoding 

^ In constructing P we only get n—1 values (excluding the diagonal). Since the minimum Hamming distance of an [n, fc — 1] 
RS code is 71 — fc + 2, the error-and-erasure decoding can only correct up to [- 
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procedure fails or the integrity check fails, then the data collector retrieves two more blocks of 
data from the remaining storage nodes. The data collector repeats the same procedure until it 
recovers the original data or runs out of the storage nodes. The detailed decoding procedure is 
summarized in Algorithm [1] 

IV. Efficient Encoding and Decoding schemes for MBR Codes 

In this section, we will find a generator matrix of the form (fTOl) such that the row with the 
maximum Hamming weight has the least number of nonzero elements. This generator matrix 
is thus a least-update-complexity matrix. A decoding scheme for MBR codes that can correct 
more error patterns is also provided. 



A. Encoding Scheme for MBR Codes 



Let g{x) = 11^=1^ — a^) = J2^=o 9i^^ be the generator polynomial of the [ra, k] RS code and 



■\n—k 
A=0 



f{x) = YVj=ii^ " (^^) = J2^=o fi^^ the generator polynomial of the [n,d\ RS code, where a is 
a generator of GF{2'^). A matrix G can be constructed as 



yn—d 



where 



and 



B 



G 



9o 9i 
go 



fo fi 
/o 



Gu 
B 



9n-k 

Qn-k-l g-n-k 



u go 

fn-d 
fn~d~l fn—d 













gi g2 ■■■ gn-k 








(26) 



(27) 



(28) 



■■■ /o ••• /„„rf ■■■ 

The dimensions of Gk and B are k x n and {d — k) x n, respectively. Next, we prove that the 
main theorem about the rank of G given in (|26l ). 



DRAFT 



January 22, 2013 



19 



Theorem 3: The rank of G given in (|26l) is d. That is, it is a generator matrix of the MBR 
code. 

Proof: Let the codes generated by Gk and G he C and G, respectively. It can be seen that 
any row in Gk and B is a cyclic shift of the previous row. Hence, all rows in Gk and B are 
linearly independent. Now we only consider the linear combination of rows in G chosen from 
both Gk and B. Since (7 is a linear code, the portion of the linear combination that contains 
only rows from Gk results in a codeword, named c, in C. Assume that the rows chosen from B 
are the joth, jith, . . ., and j^-ith rows. Recall that B can be represented by a polynomial matrix 



as 



B(x) 



fix) 
xf{x) 



X 



d-k-1 



fix) 



Hence, in the polynomial form, the linear combination can be represented as 



e-i 



cix) + ^f{x) , 



(29) 



i=0 



where c(x) is not the all-zero codeword and not all bi = 0. Since c{x) is the code polynomial 
of C, it is divisible by g{x) and can be represented as u{x)g{x). Assume that (|29l ) is zero. Then 
we have 

£-1 

u{x)g{x) = -f{x)Y,hx''~' ■ (30) 
Recall that g{x) = YYi=iix — and f{x) = YYi^iix — a*). Hence, 



n—k 



[X - a 



i=n—d+l 



gix) = f{x) n 
Substituting dlB into dSO]) we have 

7 

JJ - a') = -^h,x''~^ . 



(31) 



n—k 

u{x) JJ^ {x — a* 

i=n~d+l 



e-1 



(32) 



i=0 



That is, YllJ) hx^" ^ is divisible by HILn^ 



n—k / j^ 

d+i[x — a ^ 



n—k 



. However, the degree of YYi=n 



-d+l 



x — a 



is d — k and the degree of J2l=o ^iX''' ^ is at most d — k — 2 when i = d — k — 1, the largest 
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possible value for £. Thus, X]i=o hx^'"^ is not divisible by YYi=n-d+i(^ ~ since not all bi = 0. 
This is a contradiction. 

Since all rows in Gk and B are codewords in C, G is then a generator matrix of the [n, d] 
RS code G. U 

Corollary 4: The G given in (|26|) is the least-update-complexity matrix. 
Proof: Since niust be the generator matrix of the [n, k] RS code C, the Hamming weight 
of each row of Gk is greater than or equal to the minimum Hamming distance of C, n — k + 1. 
Since the degree of g(x) h n — k and itself is a codeword in C, the nonzero coefficients of 
g{x) h n — k + 1 and each row of Gk is with n — k + 1 Hamming weight. A similar argument 
can be applied to each row of B such that the Hamming weight of it is n — d + 1. Thus, the 
G given in (|26|) has the least number of nonzero elements. Further, Since Gk is the generator 
matrix of the [n, k] code, the minimum Hamming of its row can have is n — k + 1, namely, the 
minimum Hamming distance of the code. Hence, the row with maximum Hamming weight in 
G h n — k + \. ■ 

Since C is also a cyclic code, it can be arranged as a systematic code. Gk is then given by 





boo 


boi 


bo2 


bo{n-k-l) 


1 





■ 


■ 




bio 


bu 


bi2 


bl{n-k-l) 





1 


■ 


■ 


G = 


b20 


b2i 


b22 


&2(n-fc-l) 







1 ■ 


■ 




_ b(k-i)o 


b{k-i)i 


b{k-i)2 ■ 


■ b(^k-l){n-k-l) 








■ 


■ 1 



(33) 



where 

^n-k+i ^ Ui{x)g{x) + bi{x) for < i < A; - 1, 

and bi{x) = bio + bux + ■ ■ ■ + bi(^n-k-i)x'^~^~^ ■ It is easy to see that G with Gk as a submatrix 
is still a least-update-complexity matrix. The advantage of a systemic code will become clear in 
the decoding procedure of the MBR code. 



B. Decoding Scheme for MBR Codes 

The generator polynomial of the RS code encoded by d33l) has a""'^, aP"'^'^ , . . . ,a as roots. 
Hence, the progressive decoding scheme based on the [n, k] RS code given in [[T4ll can be applied 
to decode the MBR code. The decoding algorithm given in [[T4| is slightly modified as follows. 
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Assume that the data collector retrieves encoded symbols from (. storage nodes jo; ji: • • • : 
k < i < n. The data collector receives d vectors where each vector has £ symbols. Denoting 
the first k vectors among the d vectors as Y^xe and the remaining d — k vectors as y(d_fc)x£- 
By the encoding of the MBR code, the codewords in the last d — k rows of C can be viewed 
as encoded by Gk instead of G. Hence, the decoder of the [n, k] RS code can be applied on 
y{d-k)xe to recover the codewords in the last d — k rows of G. 

Let C(d~k)xk be the last k columns of the codewords recovered by the error- and-erasure 
decoder in the last d — k rows of G. Since the code generated by (|33T ) is a systematic code, A2 
in U can be reconstructed as 

A2 = G(d-k)xk ■ (34) 
We then calculate the joth, jith, . . ., j^_ith columns of A2 ■ B as Ek^i, and subtract Ek^i from 

Ykxi- 

^kxi — ^kxi — Ekxl ■ (35) 

Applying the error-and-erasure decoding algorithm of the [n, k] RS code again on F^'^^ we can 
reconstruct Ai as 

^1 = Ckxk ■ (36) 

The decoded information sequence is then verified by data integrity check. If the integrity check 
is passed, the data reconstruction is successful; otherwise the progressive decoding procedure is 
applied, where two more storage nodes need to be accessed from the remaining storage nodes 
in each round until no further errors are detected. 

The decoding capability of the above decoding algorithm is . Since each erroneous 

storage node sends a = d symbols to the data collector, in general, not all a symbols are wrong 
if failures in the storage nodes are caused by random faults. Hence, the decoding algorithm given 
in [fT4l| can be modified as follows to extend error correction capability. After decoding Y(^d-k)xh 
one can locate the erroneous columns of Y(^d-k)xe by comparing the decoded result to it. Assume 
that there are v erroneous columns located. Delete the corresponding columns in Ek^t and Ykxi 
and we have 

Ykx{t-v) = Ykx(l-v) — Ekx{e-v) ■ (37) 
January 22, 2013 DRAFT 
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[20,10,18] MSR Codes for Data Reconstruction 




Node Failure Probability 

Fig. 1. Comparison of the failure rate between the algorithm in 1141 and the proposed algorithm for [20, 10, 18] MSR codes 

Applying the error-and-erasure decoding algorithm of the [n,k] RS code again on '•^ 
reconstruct Ai if i—v > k; otherwise the progressive decoding is applied. The modified decoding 
algorithm is summarized in Algorithm |2] The advantage of the modified decoding algorithm is 
that it can correct errors up to 



n-k + l 


+ 


n k + 1 


2 




2 



even though not all error patterns up to such number of errors can be corrected. 

V. Performance Evaluation 

The proposed reconstruction algorithms for MSR and MBR codes have been evaluated by 
Monte Carlo simulations. They are compared with the reconstruction algorithms previously 
proposed in [fT4l . Each data point is generated from 10'^ simulation runs. Storage nodes may 
fail arbitrarily with the Byzantine failure probability ranging from to 0.5. In both schemes, 
[n, k, d] and m are chosen to be [20, 10, 18] and 5, respectively. 

In the first set of simulations, we compare the proposed algorithm with the algorithm in [ |T4l 
in terms of the failure rate of the reconstruction and the average number of node accesses, 
which indicates the required bandwidth for data reconstruction. Failure rate is defined as the 
percentage of runs for which reconstruction fails (due to insufficient number of healthy storage 
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[20,10,18] MSR Codes for Data Reconstruction 




Node Failure Probability 

Fig. 2. Comparison of the number of node accesses between the algorithm in [14] and the proposed algorithm for [20, 10, 18] 
MSR codes 

nodes). Figure [T] shows that the proposed algorithm can successfully reconstruct the data with 
much higher probability than the previous algorithm for the same node failure probability. For 
example, when the node failure probability is 0.1, only about 1% of the time, reconstruction 
fails using the proposed algorithm, in contrast to 50% with the old algorithm. The advantage 
of the proposed algorithm is also pronounced in the average number of accessed nodes for data 
reconstruction, as illustrated in Fig. |2l For example, on an average, only 2.5 extra nodes are 
needed by the proposed algorithm under the node failure probability of 0.1; while over 6.5 extra 
nodes are required by the old algorithm in [fT?]. It should be noted that the actual saving attained 
by the new algorithm depends on the setting of n, k, d and the number of errors. 

The previous and proposed decoding algorithms for MBR codes are compared in the second 
set of simulations. Figures |3] and |4] show that they have identical failure rates of reconstruction 
and average number of accessed nodes. This result implies that the special error patterns, which 
only the proposed algorithm is able to handle for successful data reconstruction, do not happen 
very frequently. However, the computational complexity of the proposed algorithm for MBR 
encoding is much lower since no matrix inversion and multiplications are needed in (|34]) and 

In the evaluation of the update complexity, we adopt the measure given in [[T6l . The update 
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[20,10,18] MBR Codes for Data Reconstruction 




Node Failure Probability 



Fig. 3. Failure-rate comparison between the previous algorithm in 1141 and the proposed algorithm for [20, 10, 18] MBR codes 



[20,10,18] IVIBR Codes for Data Reconstruction 




Node Failure Probability 

Fig. 4. Node-access comparison between the previous algorithm in 1141 and the proposed algorithm for [20, 10, 18] IVIBR 
codes 



complexity is measured by the maximum number of nonzero elements in all rows of the generator 
matrix G. Denote by ri{R) the ratio of the update complexity of the proposed generator matrix 
to that of the generator matrix given in [il4i . where R = k/n.liis easy to see that, 
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for MSR codes and 

, n — k + 1 ^ 

VMBR{Rj = P^l-R 

n 

for MBR codes. Thus, the proposed encoding schemes incur only 1 — _R of the update complexity 
of that in 

VI. Conclusion 

In this work, we proposed new encoding and decoding schemes for the [n, d] error-correcting 
MSR and MBR codes that generalize the previously proposed codes in [fT4|. Through both 
theoretical analysis and numerical simulations, we demonstrated the superb error correction 
capability, low update complexity and low computation complexity of the new codes. 

It is easy to see that there is a trade-off between the update complexity and error correction 
capability of regenerating codes. In this work, we fist find good error-correcting regenerating 
codes and then optimize their update complexity. Possible future work includes the study of 
encoding schemes that first design regenerating codes with good update complexity and then 
optimize their error correction capability. 
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Algorithm 1: Decoding of MSR Codes Based on (n, k — 1) RS Code for Data Reconstruction 

begin 

V = 0; j = k; 

The data collector randomly chooses k storage nodes and retrieves encoded data, Yaxj 

while V < L^^^J do 

Collect the j columns of G corresponding to accessed storage nodes as Gj; 

Calculate GjYaxj', 

Construct P and Q by using dJO]) and (|2T]) : 

Perform progressive error-and-erasure decoding on each row in P to obtain P; 
Locate erroneous columns in P by searching for columns of them with at least 
V + 2 errors; assume that £e columns found in the previous action; 
Locate columns in P with at most v errors; assume that ic columns found in the 
previous action; 

if (ie = V and ic = k + v) then 

Copy the £e erronous columns of P to their corresponding rows to make P a 
symmetric matrix; 

Collect any a columns in the above ic columns of P as Pa and find its 
corresponding Ga', 

Multiply the inverse of Ga to Pa to recover GjZi, 
Recover Zi by the inverse of any a rows of Gj; 

Recover Z2 from Q by the same procedure; Recover rh from Zi and Z2', 

if integrity-check(rh) = SUCCESS then 
L return rh; 

J ^ J + 2; 

Retrieve 2 more encoded data from remaining storage nodes and merge them into 

|_ Yaxj; V ^ V + 1; 
return FAIL; 
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Algorithm 2: Decoding of MBR Codes for Data Reconstruction 
begin 

The data collector randomly chooses k storage nodes and retrieves encoded data, Ydxk', 
repeat 

Perform progressive error-erasure decoding on last d — k rows in Y^xe, Y{d~k)xt, to 
recover C (error-erasure decoding performs d — k times); 
Locate the erroneous columns in Y(^(i-k)xi (assume to have v columns); 
Calculate A2 via (l34l) : 

Calculate A2 ■ B and obtain via (iJTl ); 

if (£-v> k) then 

Perform progressive error-erasure decoding on ^^'^(^-u) recover the first k 

rows in codeword vector (error-erasure decoding performs k times); 

Calculate Ai via (l36l) : 

Recover the information sequence m from Ai and A2; 

if integrity-check(m) = SUCCESS then 
L return m; 

Retrieve two more encoded data from remaining storage nodes and merge them 

into Ydxe; 
until i>n-2; 

return FAIL; 
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